CVE-2026-63799

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

sched/mmcid: Fix OOB clear_bit when CID is MM_CID_UNSET in fixup path

In mm_cid_fixup_cpus_to_tasks(), when rq->curr has the target mm and

mm_cid.active is set, the CID is checked with cid_in_transit() before

setting the transition bit. In per-CPU mode a newly forked or exec'd

task can be running with mm_cid.cid == MM_CID_UNSET because CIDs are

assigned lazily on schedule-in. With cid_in_transit() the guard passes

for MM_CID_UNSET (no transit bit), converts it to MM_CID_UNSET |

MM_CID_TRANSIT and stores it back; later mm_cid_schedout() feeds this

to clear_bit() with MM_CID_UNSET as the bit number, triggering an

out-of-bounds write.

Symptoms: this is genuine memory corruption, but a bounded out-of-bounds

write, not an arbitrary one. MM_CID_UNSET is the fixed sentinel BIT(31),

so once the bad value reaches mm_cid_schedout() the cid_from_transit_cid()

strip leaves MM_CID_UNSET, which fails the "cid < max_cids" conve

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References